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Examiner 
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-- The MAILING DATE of this c mmunication appears on the cover sheet with the c rrespondence address - 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )S Responsive to communication(s) filed on 22 October 2004 . 
2a)^ This action is FINAL. 2b)D This action is non-final. 

3) Q Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) ^3 Claim(s) 1-57 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) ^3 Claim(s) 1-57 is/are rejected. 

7) Q Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) n The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 1 19 

12) Q Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .0 Certified copies of the priority documents have been received. 

2.0 Certified copies of the priority documents have been received in Application No. . 

3.D Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 



Attach ment(s) 

1 ) £3 Notice of References Cited (PTO-892) 

2) O Notice of Draftsperson's Patent Drawing Review (PTO-948) 

3) D Information Disclosure Statement(s) (PTO-1449 or PTO/SB/08) 

Paper No(s)/Mail Date . 



4) Q Interview Summary (PTO-413) 

Paper No(s)/Mail Date. . 

5) □ Notice of Informal Patent Application (PTO-152) 

6) IZI Other: . 



U.S. Patent and Trademark Office 
PTOL-326 (Rev. 1-04) 



Office Action Summary 



Part of Paper No./Mail Date 20041227 
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DETAILED A CTION 



Claim Rejections - 35 USC □ 112 

1 . The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and 
distinctly claiming the subject matter which the applicant regards as his invention. 

2. Claim 5 is rejected under 35 U.S.C. 112, second paragraph, as being indefinite for failing 
to particularly point out and distinctly claim the subject matter which applicant regards as the 
invention. The "sourced our" is unclear. 

3. Claim 45 is rejected under 35 U.S.C. 112, second paragraph, as being indefinite for 
failing to particularly point out and distinctly claim the subject matter which applicant regards as 
the invention. TCP, SYN and FIN are acronym(s) and/or trademark(s), and thus are unclear. 



Claim Rejections - 35 USC §102 

1. The following is a quotation of the appropriate paragraphs of 35 U. S.C. 102(e) that 
form the basis for the rejections under this section made in this Office action: 

(e) the invention was described in a patent granted on an application for patent by another filed in the United 
States before the invention thereof by the applicant for patent, or on an international application by another who 
has fulfilled the requirements of paragraphs (1), (2), and (4) of section 371(c) of this title before the invention 
thereof by the applicant for patent. 

2. Claims 1-2, 5-15, 18-28, 31-41, 46-50, 55-57 are rejected under 35 U.S.C. 102(e) as 
being anticipated by Shannon with Patent Number 6,233,618. 

3. Regarding claim(s) 1,14, 27, Shannon teaches a network domain with routers to route 
traffic in and out, col. 6, lines 17-18, 23 and col. 13, lines 23-26 as "within network device" and 
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"router or gateway to the Internet". Shannon teaches monitoring network traffic at said router, 
col 13, lines 26-28. Shannon teaches determining if sourcing of undesirable traffic occurs at the 
router, col. 13, lines 34-41 as "screen" and col. 11, lines 1-10. Shannon teaches a processor with 
memory, col. 5, lines 45-46. Shannon teaches denial of service attack or access, col. 14, lines 
42-48. 

4. Regarding claim(s) 2, 15, 28, 41, 50, Shannon teaches said determination is based on 
differential characteristics of traffic routed out, col. 6, lines 45-46 as "access control is based on 
the categories or types of data to be accessed", col. 8, lines 24-30, 49-51, and based on traffic 
routed into the network, col. 13, lines 1-22 as "source address field". 

5. Regarding claim(s) 5, 9, 13, 18, 22, 26, 31, 35, 39, Shannon teaches stopping undesirable 
traffic being sourced, col 14, lines 29-20. 

6. Regarding claim(s) 6, 10, 19, 23, 32, 36, Shannon teaches a second routing device or 
network domain through which undesirable traffic is determined, col. 6, lines 1-3. 

7. Regarding claim(s) 7-8, 1 1-12, 20-21, 24-25, 33-34, 37-38, Shannon teaches detecting 
undesirable traffic between routers and/or domains, col. 6, lines 6-7. 

8. Regarding claim(s) 40, 49, Shannon teaches determining if sourcing of undesirable 
traffic/flow occurs at the router, col. 13, lines 34-41 as "screen" and col. 11, lines 1-10. 

9. Regarding claim(s) 46, 48, 55, 57, Shannon teaches priority levels as groups/categories, 
col. 7, lines 41-42. 

10. Regarding claim(s) 47, 56, Shannon teaches slowing traffic, col. 2, lines 65-66. 



Claim Rejections - 35 USC§103 
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1 1 . This application currently names joint inventors. In considering patentability of the 
claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of the various 
claims was commonly owned at the time any inventions covered therein were made absent any 
evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out 
the inventor and invention dates of each claim that was not commonly owned at the time a later 
invention was made in order for the examiner to consider the applicability of 35 U.S.C. 103® and 
potential 35 U.S.C. 102(f) or (g) prior art under 35 U.S.C. 103(a).- 

12. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth 
in section 102 of this title, if the differences between the subject matter sought to be patented and the prior 
art are such that the subject matter as a whole would have been obvious at the time the invention was made 
to a person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the invention was made. 

13. Claims 3-4, 16-17, 29-30, 42-45, 51-54, are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Shannon with Patent Number 6,233,618 in view of Trcka et al. with Patent 
Number 6,453,345. 

14. Regarding claim(s) 3, 16, 29, 42, 51, Shannon teaches the system described above. 
Shannon teaches the invention in the above claim(s) except for explicitly teaching compiling 
aggregated statistics of traffic data. In that Shannon operates to limit data forwarded, the artisan 
would have looked to the network monitoring arts for details of implementing detailed traffic 
analysis of monitored data. In that art, Trcka, a related network monitor, teaches "a window of 
time for enabling the bad packets to be evaluated", col. 6, lines 61-62 in order to provide a more 
accurate determination. Trcka specifically teaches "providing] a temporary record of the good 
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and bad packet data, respectively), and are used to enable the system to automatically monitor 
the traffic near real-time' 1 ", col 14, lines 50-53 with "comparison", col. 19, lines 23-30 and 
"statistics", col. 21, line 26. Statistics relevant to all data sent is taught. Further, Trcka suggests 
"the system includes various components for automatically analyzing the network traffic in near 
real-time", col. 8, lines 64-65 which will result from implementing his data analysis. The 
motivation to incorporate statistics insures that more relevant data is used to make a 
determination. Thus, it would have been obvious to one of ordinary skill in the art to incorporate 
the differential statistics as taught in Trcka into the monitor described in the Shannon patent 
because Shannon operates with grouping data and Trcka suggests that optimization can be 
obtained with group statistics. Therefore, by the above rational, the above claim(s) are rejected. 

15. Regarding claims 4, 17, 30, Trcka teaches aggregating said input and output 
characteristics, col. 19, lines 25-27 as "evaluating] the effectiveness of the firewall". Thus, the 
above claim limitations are obvious in view of the combination. 

16. Regarding claim 43-45, 52-54, the Shannon and Trcka patents disclose the method of the 
preceding claims. The Shannon and Trcka patents do not explicitly disclose all the details 
relating to specific types of statistics such as packet lengths, TTL, and inbound versus outbound 
packets,. However, Official Notice is taken MPEP 2144.03 (a)) that details relating to specific 
types of statistics is well known in the art to insure a complete data set. It would have been 
obvious to one of ordinary skill in the art at the time of the application's invention to provide 
details relating to specific types of statistics to obtain the advantages of having a complete data 
set. By the above rational, the claim is rejected. 
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Response to Amendment 

1. The broad claim language used is interpreted on its face and based on this interpretation 
the claims have been rejected. 

2. The limited structure claimed, without more functional language, reads on the references 
provided. Thus, Applicant's arguments can not be held as persuasive regarding patentability. 

3. Applicant suggests "DOS attacks do not appear to be mentioned", Paper filed 10/22/04, 
Page 22, line 18. However, Shannon teaches denial of service attack or access, col. 14, lines 42- 
48, and the direction of Shannon is not dispositive. Thus, Applicant's arguments can not be held 
as persuasive regarding patentability. 



Conclusion 

1 7. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure is disclosed in the Notice of References Cited. A close review of the references is 
suggested. A close review of the Cunningham et al. reference with Patent Number 6,219,786 
and Krishnan reference with Patent Number 6,366,956 is suggested. The other references cited 
teach numerous other ways to perform network device content control, thus a close review of 
them is suggested. 

4. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

5. A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
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the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

6. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Stephan Willett whose telephone number is (571) 272-3890. The 
examiner can normally be reached Monday through Friday from 8:00 AM to 6:00 PM. 

7. If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Rupal Dharia, can be reached on (571) 272-3880. The fax phone number for the 
organization where this application or proceeding is assigned is (703) 872-9306. 

8. Any inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the receptionist whose telephone number is (571) 272-2100. 

sfw 

January 5, 2005 




